Hiding in a virtual world: Using unconventionally installed operating systems

Abstract

Necessity is the mother of invention, and necessity has produced many software and hardware tools in the realm of computer networking and security to overcome problems encountered in the private and public sector. Unconventionally installed operating systems including virtual machines, operating systems installed on removable media and external storage drives are some recent inventions. These tools have been very useful to network administrators, but they can also be used in ways not intended by their creators in an attempt to mask the activities of a user. This paper will attempt to evaluate the possibility of using these unconventionally installed operating systems in an attempt to hide one's activities from conventional digital forensic tools. This evaluation will be conducted by repeating a series of tests inside a virtual environment, then overwriting the virtual environment flat file and having the host computer imaged and examined by forensic tools.